What Is The Personal Data Protection Act, 2022 (Act No. 11 of 2022)?
Tanzania's Personal Data Protection Act, 2022 (Act No. 11, Chapter 44) applies to Mainland Tanzania and Tanzania Zanzibar, except that in Zanzibar it does not apply to non-union matters. Parliament enacted it in November 2022, the President assented in December 2022, and it came into force 1 May 2023; the Personal Data Protection Commission (PDPC) says its full operational mandate was inaugurated 3 April 2024, with full enforcement announced from 9 April 2026. Section 33 entitles a data subject to information about whether their data is processed and its purposes, recipients, and (for significant automated decisions) the logic involved. The 2023 Regulations prescribe forms for rectification (Form 5, 14-day controller decision), erasure/destruction (Form 6, 14-day consideration, with exceptions for expression, legal obligations, and public interest), restriction of harmful processing (section 34), and stopping direct marketing (section 35). A complaint to the Commission is investigated and concluded within 90 days, extendable by up to a further 90 days. This is a source-backed evidence profile. The Act and 2023 Regulations are published in English and Swahili, with the English regulations text expressly identified as a translation. No Tanzania-specific data-broker opt-out registry or public-record suppression route was located; a specific statutory access-response deadline was not located either, and should not be assumed from other jurisdictions' timelines.
At a glance
- Full name
- The Personal Data Protection Act, 2022 (Act No. 11 of 2022)
- Short code
- Tanzania PDPA 2022
- Jurisdiction
- United Republic of Tanzania
- Enacted
- 2022
- Last major update
- In force 1 May 2023; PDPC’s full operational mandate inaugurated 3 April 2024; full enforcement announced from 9 April 2026
- Regulator
- Personal Data Protection Commission (PDPC)
- Private right of action
- Limited
- Statutory citation
- The Personal Data Protection Act, 2022 (Act No. 11 of 2022)
Scope, who Tanzania PDPA 2022 covers
Protected data
Data subject rights
Information about whether data is processed, its purposes, recipients, and (for significant automated decisions) the logic involved (section 33)
Restriction or prevention of processing likely to cause substantial damage (section 34)
Stop processing for direct-marketing purposes (section 35)
Rectification via prescribed Form No. 5, with a 14-day controller decision (2023 Regulations)
Erasure or destruction via prescribed Form No. 6, with a 14-day consideration period, subject to freedom-of-expression, legal-obligation, and public-interest exceptions
Notable features
The Act’s Mainland/Zanzibar non-union-matters scope boundary is a distinctive structural feature reflecting Tanzania’s union-government constitutional structure. The PDPC reported active compliance inspections beginning in 2026.
Enforcement & penalties
Regulator: Personal Data Protection Commission (PDPC)
Penalties: The reviewed PDPC Act and Regulations for this research pass focused on rights, forms, and the complaint process rather than a consolidated fine schedule; a penalty figure should be checked directly against the Act’s offence provisions.
Private right of action: A person who considers a controller or processor has infringed data-protection principles may file a complaint with the PDPC (online via Form No. 1, or in person in Dodoma or Zanzibar); the Commission investigates and concludes within 90 days, extendable by up to a further 90 days.
Relevance to data brokers
No Tanzania-specific data-broker opt-out registry, public-record suppression route, or broker-specific removal channel was located. The located official route is the general controller/processor rights-request and PDPC complaint framework; a broker’s classification and the application of any right to a particular record require entity-level legal review.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does Tanzania’s data-protection law apply in Zanzibar?+
Yes, except for Zanzibar non-union matters, which the Act expressly excludes.
How long does the PDPC have to resolve a complaint?+
The Act gives the Commission 90 days from receipt to investigate and conclude a complaint, extendable by up to a further 90 days.
Official sources & citations
Other international privacy regimes
Tanzania PDPA 2022 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: